[ Ransomware claim · lamashtu · 24 Oct 2026 ]
Vins Viallet
The ransomware group lamashtu named Vins Viallet (France) on its leak site on 24 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from Vins Viallet and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is Vins Viallet?
- What it does
- Vins Viallet, also known as Maison Viallet or Maison Philippe Viallet, is a family-rooted wine producer and négociant in Savoie in the French Alps. It makes and trades white, red, rosé and sparkling Savoie wines from grape varieties such as Jacquère, Mondeuse, Altesse and Roussanne. Since 2025 it has been part of the Clos Réserve holding company, which brings together five Savoie wine estates.
- Based in
- Apremont, Savoie, France
- Founded
- 1966, when the family bought the Clos Réservé vineyard in Apremont; the trading business was set up in 1985
- Size
- estimated revenue of about 12 million euros for 2025-2026, according to Le Journal des Entreprises
- Who it serves
- Its wines are sold through supermarkets in the Rhône-Alpes region and online, and the group is working to grow sales to cafés, hotels and restaurants and in wider markets.
Partners and customers it names publicly
- Clos Réserve, holding company that owns Maison Viallet
- Domaine Perrier, sister Savoie estate in the Clos Réserve group
- La Cave Idéale, the group's online wine shop
[ Impact ]Who could be affected
Retailers, restaurants and importers that buy its wines could see delays to orders, invoices or deliveries if its systems were disrupted. Online shoppers and trade customers whose names, addresses or order details are held by the business could be affected if any data was accessed. Growers and suppliers who work with the négociant could also see delayed payments or contracts.
In retail & e-commerce generally: Shoppers can face order delays and phishing that uses their order history, and online shops hold names, addresses and sometimes payment data.
[ The attacker ]About lamashtu
Lamashtu is a data extortion group first seen in early 2026 that threatens to publish stolen data and to contact victims' clients and regulators, and security trackers class it more as a data broker than a traditional encrypting ransomware group. It has named victims across Europe, the United States and Asia in sectors including food and beverage, manufacturing and hospitality.
lamashtu has claimed 7 organisations in the last 30 days, most in Germany and France, and mostly in manufacturing, retail & e-commerce and agriculture and food production.
Other organisations lamashtu has named
- Germany
- Germany
- Germany
- Germany
- France
[ What to do ]If you are a customer, partner or neighbour
- Be wary of emails or calls about your wine orders or invoices that ask for payment or a change of bank details, and confirm by phone with a known contact.
- If you have an account on the online shop, change the password and do not reuse it elsewhere.
- Check card statements for any payment you do not recognise if you have bought from the business online.
- Trade customers should verify any change in delivery or invoicing instructions directly with their usual sales contact.